The usual culprits are often in /var/, unless /var/ is its own partition on your system.

If you have lsof, this can help show you which files are actually open. So can
ls -l /proc/[0-9]*/fd/ on some systems, particularly linux.

Beware -- do not simply delete the problem file when you find it! If it's still held open by anything, it will not be removed from disk, just removed from the directory -- forcing you to kill processes or reboot to close the file and fix the problem.

Truncate the file instead, i.e.
: > filename to reduce it to zero bytes in size.